Spacelift

Spacelift is an infrastructure as code orchestration platform for platform teams running Terraform, OpenTofu, Pulumi and Ansible, hosted or self-hosted.

Spacelift runs infrastructure changes for teams that have outgrown one pipeline script per repository. It takes Terraform, OpenTofu, Pulumi, CloudFormation, Terragrunt, Ansible and Kubernetes code from version control and runs every plan and apply under one set of rules. Spacelift, Inc. builds it. The company dates from 2020 and is based in Redwood City, California. The unit of work is a stack, which ties a repository and branch to a tool and its settings. A push to a feature branch starts a proposed run that previews the change and reports back on the pull request. Plan policies fail a run that breaks a deny rule, approval policies hold a run until a reviewer signs off, and drift detection reruns proposed runs on a schedule. Spaces and Contexts group stacks and shared settings under role-based access control, while stack dependencies pass outputs from one stack to the next. Blueprints and Templates let developers create stacks inside limits the platform team sets, and Spacelift Intelligence adds an AI assistant for designing, deploying and governing infrastructure. Platform engineers and DevOps teams are the main users, especially where several infrastructure tools and many cloud accounts need a single workflow. It fits organizations moving off Terraform Cloud, Terraform Enterprise or a generic CI/CD setup, and teams moving from Terraform to OpenTofu. Runs execute on Spacelift's public workers or on private worker pools hosted inside a team's own network. Regulated organizations can run the whole platform self-hosted, with FedRAMP and air-gapped options. A typical change starts as a pull request against a Terraform or OpenTofu repository. It gets a proposed run with an Infracost estimate, then waits for a reviewer before it applies. Cloud integrations for AWS, Azure and Google Cloud hand each run short-lived credentials. Teams also import resources built by hand into managed state, delete temporary stacks on a schedule and publish versioned modules to the private registry. The result is one reviewed path from a code change to the cloud account it touches.